Félix Herrenschmidt Profile Picture
Incident Handler @ Thales CERT

Félix HERRENSCHMIDT

Cyber Security Incident Handler Specialist

Bridging technical DFIR expertise with strategic cybersecurity leadership. Dedicated to protecting critical assets, leading complex incident response, and building global digital resilience.

Overview

About & Vision

Bridging Technical Excellence & Strategic Leadership

"My years as a frontline Incident Responder at CERT Thales and my technical background (GCFA, FOR608, FOR572…) have taught me a key lesson: technical excellence is vital, but strategic planning truly moves the needle. For me, earning the GIAC GSTRT Certification (Strategic Planning, Policy, and Leadership) isn't just a badge; it’s about bridging the gap between deep-dive forensics and high-level leadership. Ready for the challenges ahead!"

Continuously expanding horizons from deep-dive Blue Team defense towards strategic cyber operations and offensive perspective insights.

GCFA Badge
Incident Response & DFIR
Thales CERT • GIAC GCFA Certified
GSTRT Badge
Strategic Leadership
GIAC GSTRT Certified
Threat Hunting
Watcher Creator

Career Path

Professional Experience

Thales

Cyber Security Incident Handler Specialist
Thales CERT
Sep. 2019 – Present
Gémenos & Paris, France
  • Manage security incidents reported to Thales CERT worldwide, providing technical and quality Digital Forensics and Incident Response (DFIR).
  • Community Leadership: Managed a global network of 50 CERT Champions across Thales, enhancing international incident response capabilities and embedding a proactive security culture.
  • Designed and built Watcher, an open-source Cyber Threat Hunting software (Django & React JS) automating threat intelligence and attack surface surveillance for Thales assets.
Incident Response Digital Forensics Strategic Planning Cyber Threat Hunting Watcher

Eurosmart

Cybersecurity Engineer Intern
Jun. 2019 – Sep. 2019 (4 months)
Brussels, Belgium

Improved infrastructure and security of Eurosmart support and business assets. Contributed to the creation of a new European IoT Certification Scheme compliant with the European Cybersecurity Act (elaboration of security profiles based on DIN SPEC 27072 and ETSI TS 103 645). Developed an open-source iOS Swift application ("Eurosmart Drive") enabling secure 2FA FIDO token access to Synology NAS storage.

IoT Security Schemes iOS Swift FIDO 2FA ISO Standards

Promo-ISEN

President of Promo-ISEN
Sep. 2018 – May 2019 (9 months)
Toulon, France

Led a team of 35 student volunteers in managing internal and external promotion events for ISEN-Toulon Engineering School. Organized the Digital Native Forum welcoming 35 technology companies for student recruitment.

Team Leadership Event Management 35 Volunteers

Qualifications

Certifications & Education

GIAC & Industry Certifications

GIAC GCFA Badge
GIAC Certified Forensic Analyst (GCFA)
GIAC Certification • Issued Jul 2023 - Exp Jul 2031
GCFA
GIAC GSTRT Badge
GIAC Strategic Planning, Policy, and Leadership (GSTRT)
GIAC Certification • Issued Mar 2026 - Exp Mar 2030
GSTRT
FOR572: Advanced Network Forensics: Threat Hunting & Incident Response
SANS Institute • Issued Jan 2025
Network Forensics
FOR608: Enterprise-Class Incident Response & Threat Hunting
SANS Institute • Issued Jan 2024
Enterprise Incident Response
FOR508: Advanced Incident Response, Threat Hunting & DFIR
SANS Institute • Issued Nov 2022
Digital Forensics
DF210 - EnCase Computer Forensics Training
OpenText • Issued Jul 2021
EnCase
Cisco® CCNA Cybersecurity Operations
Cisco Networking Academy • Issued Feb 2020
CCNA CyberOps

Education & Languages

ISEN Engineering School

Master's Degree in Computer Engineering

2015 – 2020 • Focus on Cybersecurity.

Languages
French Native / Bilingual
English Fluent (B2 First Certified)

Innovations & Code

Featured Projects

Featured Open Source Project

Watcher - Open Source Threat Hunting Platform

Building and maintaining "Watcher", a comprehensive Cybersecurity Threat Hunting platform developed with Django & React JS. Designed to automate and facilitate the surveillance of digital assets and threat intelligence for Thales Group CERT.

Django React JS Threat Hunting Threat Intelligence OSINT & CTI
View Watcher on GitHub
Watcher CTI Platform

Eurosmart Drive & IoT Profiles

Developed a secure-by-design iOS Swift application with 2FA FIDO token authentication allowing secure remote access to Synology NAS files. Formulated 2 IoT Security Profiles based on DIN SPEC 27072 and ETSI TS 103 645 for Eurosmart IoT certification scheme.

iOS Swift FIDO 2FA ETSI TS 103 645
GitHub Repo

ISEN Cybersecurity Lab Fleet

Project manager for setting up the cybersecurity lab at ISEN-Toulon: configured and managed a fleet of 16 iMacs, 4 servers, Cisco routers, D-link switches, and IoT electronic cards (HackRF One, Raspberry Pi) using Puppet, Munki, and Active Directory.

Cyber Lab Puppet & Munki Active Directory
ISEN Toulon Engineering